Compare commits

..
Author SHA1 Message Date
james.maesandCodex cec8b38f34 ci: centralize branch verification and source scanning
Co-Authored-By: Codex <noreply@openai.com>
2026-10-21 12:17:25 -05:00
james.maes 3d81e31279 Merge pull request #7 from QRun-IO/feature/ga-only-release-tags
ci: publish only GA tags (vX.Y.Z), never RC tags
2026-10-12 16:14:41 -05:00
james.maesandClaude Opus 5.5 615a708c06 ci: publish only GA tags (vX.Y.Z), never RC tags
An RC tag matched /v.*/ and the orb republished it as the next RC.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 16:00:38 -05:00
james.maes e098c623c0 chore: bump version to 1.6.1-SNAPSHOT, qqq 0.41.0-SNAPSHOT 2026-03-29 17:43:17 -05:00
james.maes e9d36a7b9f chore: merge release/1.6.0 back to develop 2026-03-29 17:42:43 -05:00
7 changed files with 128 additions and 115 deletions

No files matched your search

+10 -73
View File
@@ -1,77 +1,14 @@
version: 2.1
setup: true
orbs:
qqq-orb: kingsrook/qqq-orb@0.5.0
commands:
configure-package-install:
steps:
- run:
name: Keep package installation unattended
command: |
# These build machines are discarded after the job.
sudo install -d /etc/needrestart/conf.d
printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
qqq-orb: kingsrook/qqq-orb@0.7.15
workflows:
test_only:
setup:
jobs:
- qqq-orb/mvn_test_only:
pre-steps:
- configure-package-install
context: [ qqq-maven-registry-credentials ]
filters:
branches:
ignore: /(develop|release/.*|hotfix/.*|integration.*)/
tags:
only: []
publish_snapshot:
jobs:
- qqq-orb/mvn_publish:
pre-steps:
- configure-package-install
context: [ qqq-maven-registry-credentials ]
branch_type: snapshot
filters:
branches:
only:
- develop
publish_release_candidate:
jobs:
- qqq-orb/mvn_publish:
pre-steps:
- configure-package-install
context: [ qqq-maven-registry-credentials ]
branch_type: release_candidate
filters:
branches:
only:
- /release\/.*/
publish_release:
jobs:
- qqq-orb/mvn_publish:
pre-steps:
- configure-package-install
context: [ qqq-maven-registry-credentials ]
branch_type: release
filters:
branches:
ignore: /.*/
tags:
only: [ /v.*/ ]
publish_hotfix_release:
jobs:
- qqq-orb/mvn_publish:
pre-steps:
- configure-package-install
context: [ qqq-maven-registry-credentials ]
branch_type: hotfix
filters:
branches:
only:
- /hotfix\/.*/
- qqq-orb/generate_pipeline:
orb_version: 0.7.15
filters:
branches:
ignore: automation/qbit-rc-pending
tags:
only: /^v\d+\.\d+\.\d+$/
-1
View File
@@ -1 +0,0 @@
* @KofTwentyTwo
+23
View File
@@ -0,0 +1,23 @@
name: CodeQL
'on':
push:
branches:
- main
- develop
- release/**
- hotfix/**
pull_request: {}
schedule:
- cron: 41 16 * * 0
workflow_dispatch: {}
permissions:
contents: read
actions: read
security-events: write
packages: read
concurrency:
group: codeql-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
analyze:
uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22
+16
View File
@@ -0,0 +1,16 @@
profile: qbit
orb_version: 0.7.15
default_branch: main
java_version: '21'
browsers: true
api_checks: false
docs_only: false
release_on_main: false
release_tag_policy: stable
test_branch_policy: feature-no-hotfix
publish:
snapshot: true
release_candidate: true
release: true
hotfix: true
asciidoc: false
-19
View File
@@ -1,19 +0,0 @@
# CLAUDE.md — qbit-bom
## Knowledge base
Reviewed dossiers for this repo and the wider QQQ platform live in the second-brain vault:
- Hub / start here: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/qqq-hub.md`
- This repo's dossier: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/repos/qbit-bom.md`
(reviewed at commit `dd9a67723a7d`, branch `main`, 2026-07-04)
Key orientation facts (details and caveats in the dossier):
- Despite the repo name and README, this repo publishes `com.kingsrook:qbit-build-parent` —
the shared Maven parent POM for the qbit repos. It is NOT a qbit-version BOM, and the
README's `io.qrun:qbit-bom` coordinates do not exist on Maven Central.
- v1.6.0 imports `com.kingsrook.qqq:qqq-bom-pom:0.40.0` (Java 21, junit-bom 6.0.1);
develop pins `0.41.0-SNAPSHOT`, which no longer resolves (qqq renumbered to 4.0.x).
- Known licensing inconsistency: LICENSE/NOTICE = Apache-2.0, pom `<licenses>` = AGPL-3.0
(shipped to Central in 1.6.0), README says Proprietary. See dossier "Maturity & risks".
+78 -21
View File
@@ -1,37 +1,94 @@
# QBit Build Parent
# qbit-bom
This repository publishes the Maven parent **`com.kingsrook:qbit-build-parent`**. Version **2.0.0** imports **`com.kingsrook.qqq:qqq-bom-pom:4.0.0`**, sets Java 21 compilation defaults, and provides shared release plugin configuration. Use it to adopt QQQ 4.0 in a QBit project.
Maven Bill of Materials for QBit dependencies.
## Use the parent
**For:** QQQ developers managing multiple QBit dependencies
**Status:** Stable
## Why This Exists
QBits have interdependencies and version requirements. Managing compatible versions across qbit-user-role-permissions, qbit-workflows, qbit-webhooks, and others becomes tedious. Version mismatches cause runtime errors.
This BOM (Bill of Materials) declares compatible versions for all QBits. Import it once and omit version numbers from individual QBit dependencies.
## Features
- **Version Management** - Single source of truth for QBit versions
- **Compatibility Guarantee** - All declared versions tested together
- **Simplified POMs** - No version numbers on individual dependencies
- **Transitive Alignment** - Consistent versions for shared dependencies
## Quick Start
### Import the BOM
Add to your `pom.xml` in the `<dependencyManagement>` section:
```xml
<parent>
<groupId>com.kingsrook</groupId>
<artifactId>qbit-build-parent</artifactId>
<version>2.0.0</version>
<relativePath/>
</parent>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>io.qrun</groupId>
<artifactId>qbit-bom</artifactId>
<version>1.5.0</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
```
<groupId>com.example.qbits</groupId>
<artifactId>my-qbit</artifactId>
<version>1.0.0-SNAPSHOT</version>
### Add QBits Without Versions
```xml
<dependencies>
<dependency>
<groupId>com.kingsrook.qqq</groupId>
<artifactId>qqq-backend-core</artifactId>
</dependency>
<dependency>
<groupId>io.qrun</groupId>
<artifactId>qbit-user-role-permissions</artifactId>
<!-- version managed by BOM -->
</dependency>
<dependency>
<groupId>io.qrun</groupId>
<artifactId>qbit-workflows</artifactId>
</dependency>
<dependency>
<groupId>io.qrun</groupId>
<artifactId>qbit-webhooks</artifactId>
</dependency>
</dependencies>
```
Requires Java 21 and Maven 3.8 or later. Resolve releases from Maven Central. The imported QQQ BOM supplies framework dependency versions; **production QBit dependency versions are still chosen by each application**. This parent does not certify the production QBit fleet as compatible with QQQ 4.0.
## Included QBits
The previous parent release, 1.6.0, imports QQQ 0.40.0. Moving to parent 2.0.0 therefore includes QQQ's breaking API changes; follow the [4.0 migration guide](https://github.com/QRun-IO/qqq/blob/main/docs/migration/4.0.adoc).
| QBit | Current Version |
|------|-----------------|
| qbit-user-role-permissions | 0.3.0 |
| qbit-workflows | 0.2.0 |
| qbit-webhooks | 0.2.0 |
| qbit-sftp-data-integration | 0.2.0 |
| qbit-standard-process-trace | 0.1.0 |
| qbit-customizable-table-views | 0.2.0 |
## Release workflow
## Compatibility
The parent can be published only after its imported final QQQ BOM is available. Run `mvn clean verify` and test consumption from a separate child project before tagging. The existing CircleCI release workflow publishes a final version tag through the `release` Maven profile; a `release/*` branch produces a release candidate.
| BOM Version | QQQ Core Version | Java |
|-------------|------------------|------|
| 1.5.x | 0.35.0+ | 21 |
| 1.4.x | 0.27.0 - 0.34.x | 17 |
| 0.3.x | 0.25.0 - 0.26.x | 17 |
| 0.2.x | 0.22.0 - 0.24.x | 17 |
| 0.1.x | 0.20.0 - 0.21.x | 17 |
## Project Status
Stable. Updated with each QBit release.
## Contributing
1. Fork the repository
2. Update versions in `pom.xml`
3. Submit a pull request
## License
See [LICENSE](LICENSE) and [NOTICE](NOTICE).
Proprietary - QRun.IO
+1 -1
View File
@@ -42,7 +42,7 @@
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<!-- use revision property in children -->
<revision>2.0.0</revision>
<revision>1.6.1-SNAPSHOT</revision>
</properties>
<!-- Common dependency BOMs -->